<?php
 include "counter.php";
?>
<?php pagehead("Linux Counter: The Second Slashdot Experience") ?>
<BODY bgcolor="white">
<?php pagetop("The Second Counter Slashdot Experience") ?>
<!--
<blockquote>
<table border>
<tr><td>
<strong>NOTE from March 12: Please do NOT mention this page Slashdot now - I don't want to
have the box slashdotted next week - I'm on a different continent
and can't reboot it!</strong>
<br>
Ideally, I'd want to have it slashdotted only when it's become faster...HTA
</table>
</blockquote>
-->
On February 23, 1999, around 15:43 European Time, the
<a href="/">Linux Counter</a>
was <a href="http://www.slashdot.org/articles/99/02/23/1049219.shtml">
listed</a> on <a href="http://slashdot.org">Slashdot</a>, causing a
<a href="../">breakdown of services</a>.
<p>
On Thursday, February 25, 1999, at 11:07 their time, they
<a href="http://www.slashdot.org/articles/99/02/25/117248.shtml">
did it again</a>.
<p>
This is a chronicle of what happened.
<h2>The Linux Counter Setup</h2>
The Linux Counter is a project that has been running since 1993, with
the chief aim of letting people tell the world "I use Linux".
<p>
It is currently running on a 90 MHz Pentium machine, which was upgraded
to 48 Mbytes of RAM.<br>
It is located in Norway, and its connection to the outside world is through
a 256 Kbit/second leased line. Its timezone is European (MET, +0100),
six hours ahead of the US East Coast, nine hours ahead of California.
<p>
This time, the counter stayed up.
<p>
I won't say that it handled the load effortlessly - a modern Linux
box with the load in the high 10s is <em>not</em> a pretty sight.
<br>
I guess many users were turned off by the long delays and didn't get
registered; still, many <em>did</em> get through, and got registered.
<p>
Things are back to normal now; see the
<a href="/reports/hourstats.php">running stats</a> for what the
current situation looks like.

<h2>Number of visitors per hour</h2>
<img src="visitorshour.gif">
<p>
This image shows a well-configured (but underpowered) machine's
response to slashdot:
<ol>
<li>Valiant shouldering of the load
<li>Trouble from an unexpected source
<li>Slow return to normality
</ol>
In the first minute after the article went up, people arrived.<p>
Soon, the 16 available processes were all busy running my too-heavy
Perl scripts, and the new clients were sending SYN packets and
waiting. And they kept on doing it.
<p>
In fact, so many were doing this that the kernel wondered if there
were SYN flood attacks going on. Go figure...
<p>
Shortly after midnight, the /var partition, where the HTTP logfiles go,
filled up. Apparently something else required access to that partition
too  - at least registrations weren't successful either.
<br>
Luckily, I was online at the time, deleted a couple of files, and
watched the counter come back to normal.
<br>
After that, it was plain sailing.

<h2>Number of operations per hour</h2>
<img src="byhour.gif">
<p>
This one graphs successful registrations. It went to 300 and
<em>stayed</em> there for many hours. You can see the disk-full event
shortly after midnight.<br>
The peak to the left is the tail end of the <em>previous</em> Slashdot
experience; you can tell how much lower than this one it is.

<h2>Number of Web accesses per hour, last 3 days</h2>
<img src="wwwbyhour.gif">
<p>
I didn't know the little box could do that much....

<h2>Load on the access line</h2>
<img src="access-ut-day.gif">
<p>
This time, I was able to capture the day graph before the start of
slashdot rolled off the lefthand side. A 90 MHz pentium IS able to
serve 200 kbits/second of web pages - but only when the script
processors aren't hogging the CPU.
<p>Note: This graph isn't aligned with the others!
<p>
<img src="access-ut-week.gif"><p>
The week embedding both slashdot events.

<h2>Load on the server</h2>
<img src="dokka-load-day.gif">
<p>
If you want to see a Linux box in pain, look no further :-)
<br>
The red line corresponds to a load of "1"; until the disk filled,
the load had been stable around 12 since the article was posted.

<h2>Who were all these people?</h2>
<img src="visitors.gif"><p>
About 8000 people (different IP numbers) visited the site on the 25th;
about 1600 people a day managed to execute one or more scripts.
<p>
Since the counter lets people tell which country they live in, this
actually tells us something about Slashdot readers.
<p>
<img src="storybyday.gif">
<p>
Here are some comparative numbers for Days Before Slashdot,
Days During Slashdot, and Days After Slashdot.
<table border>
<tr><th>Date<th>US<th>Canada<th>Germany<th>Norway
<tr><td>Feb 13<td>24<td>4<td>8<td>0
<tr><td>Feb 26<td>582<td>98<td>35<td>8
<tr><td>Feb 27<td>563<td>80<td>53<td>21
<tr><td>Mar 6<td>42<td>7<td>6<td>4
</table>
In words: The North Americans increased by roughly a factor of 20,
fallling back to a number double their previous registration rate;
the Europeans multipled by perhaps five times, and fell back to
roughly their previous registration rate.
<br>
(Of course, such an "analysis" would get me flunked on a statistics
exam - however, I think the tendency is about right; if 563 out of
the US' 266 million people registered on the 27th, and 53 out of Germany's
83 million did, doesn't that indicate that there are four times as
many Slashdot readers per capita in the US as in Germany?)

<h2>Lessons learned</h2>
<ul>
<li>Slashdotting is still good for you, as an exercise in work under fire.<br>
The counter's configuration has proved that it stays up and running
(as long as there is disk space around).
<li>A well-handled Slashdot load lasts longer and has more people in
it than the load left after the server's been down for a while.
<li>The adrenaline kick of a slashdotting still feels <em>real</em> good!
<li>On the 25th and 26th together, 2670 people registered with the counter.
</ul>
Enjoy!

<?php pagebottom() ?>
</body>
</html>


